Senior Third-Party Risk & Security Engineer

Archer; San Jose (CA); On-site; USD 207,000 - 259,000; Full time

Job summary

Archer seeks a Senior Third Party Risk Management Engineer to build and lead Archer's TPRM program across the vendor ecosystem. You will monitor third-party risk using BitSight, investigate signals, and translate findings into actionable guidance for Security, Sourcing, Legal, and executives.

The role requires hands-on security depth, program-building ability, and ensuring compliance with NIST SP 800-171, CMMC Level 2, and DFARS. A DoD security clearance eligibility is required.

Qualifications

• 7+ years in cybersecurity with at least 3 years in third-party or supply chain risk management
• Hands-on proficiency with BitSight or equivalent continuous monitoring platform
• Deep knowledge of NIST SP 800-161 (C-SCRM), NIST CSF, CMMC Level 2 SR and ISO 27036
• Experience conducting structured vendor security due diligence across SaaS, cloud, hardware, and services
• Ability to translate risk findings into executive-ready briefings and actions
• Eligibility to obtain a DoD Secret security clearance

Responsibilities

• Operate BitSight and monitoring platforms to assess Archer's third-party attack surface
• Investigate and triage vendor risk signals; correlate external signals with internal data
• Identify 4th-party sub-processor dependencies and map supply chain risks
• Issue formal findings and coordinate remediation with procurement and legal
• Produce executive risk briefings, board dashboards, and ad-hoc analyses
• Develop risk questionnaires and integrate due diligence into procurement workflow
• Maintain TPRM policies and provide audit-ready evidence of controls and remediation
• Lead vendor-related security incidents with internal IR and legal teams

Skills

Third-party risk

Security governance

Executive communication

Tools

BitSight

NIST CSF

CMMC Level 2 SR

ISO 27036

Job description

Archer seeks a Senior Third Party Risk Management Engineer to build and lead Archer's TPRM program across the vendor ecosystem. You will monitor third-party risk using BitSight, investigate signals, and translate findings into actionable guidance for Security, Sourcing, Legal, and executives.

The role requires hands-on security depth, program-building ability, and ensuring compliance with NIST SP 800-171, CMMC Level 2, and DFARS. A DoD security clearance eligibility is required.